> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index f0ca69f888fa..c7ebddb66385 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -10349,10 +10349,27 @@ static bool check_btf_id_ok(const struct
> bpf_func_proto *fn)
> return true;
> }
>
> +static bool check_mem_arg_rw_flag_ok(const struct bpf_func_proto *fn)
> +{
> + int i;
> +
> + for (i = 0; i < ARRAY_SIZE(fn->arg_type); i++) {
> + enum bpf_arg_type arg_type = fn->arg_type[i];
> +
> + if (base_type(arg_type) != ARG_PTR_TO_MEM)
> + continue;
> + if (!(arg_type & (MEM_WRITE | MEM_RDONLY)))
> + return false;
Does this check also apply to ARG_PTR_TO_FIXED_SIZE_MEM? Looking at the
definition in include/linux/bpf.h:
ARG_PTR_TO_FIXED_SIZE_MEM = MEM_FIXED_SIZE | ARG_PTR_TO_MEM,
Since base_type() masks off the flags, base_type(ARG_PTR_TO_FIXED_SIZE_MEM)
returns ARG_PTR_TO_MEM. But ARG_PTR_TO_FIXED_SIZE_MEM does not include
MEM_WRITE or MEM_RDONLY in its definition.
Several helpers in net/core/filter.c use ARG_PTR_TO_FIXED_SIZE_MEM without
additional flags:
bpf_tcp_raw_gen_syncookie_ipv4_proto:
.arg1_type = ARG_PTR_TO_FIXED_SIZE_MEM,
bpf_tcp_raw_gen_syncookie_ipv6_proto:
.arg1_type = ARG_PTR_TO_FIXED_SIZE_MEM,
bpf_tcp_raw_check_syncookie_ipv4_proto:
.arg1_type = ARG_PTR_TO_FIXED_SIZE_MEM,
.arg2_type = ARG_PTR_TO_FIXED_SIZE_MEM,
bpf_tcp_raw_check_syncookie_ipv6_proto:
.arg1_type = ARG_PTR_TO_FIXED_SIZE_MEM,
.arg2_type = ARG_PTR_TO_FIXED_SIZE_MEM,
Would these helpers fail check_func_proto() after this change, causing
BPF programs using them to fail verification? Should these prototypes
be updated to include MEM_RDONLY (since they read from the memory), or
should the check skip ARG_PTR_TO_FIXED_SIZE_MEM?
> + }
> +
> + return true;
> +}
[ ... ]
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/20781625347
